Original subtitles

1

Welcome on this lesson we'll be using a ransomware, please do this practice in your windows virtual machine

2

File type. File type identification is essential to identify the malware's target operating system and its architecture.

3

Windows executables files are PE format.

4

On this lesson we are going to learn how to identify the file under analysis

5

first we start our Windows virtual machine

6

Before start I must warn you we are using the malware sample Rams1 which is a type of ransomware, we already talk about precautions

7

in section “Before start any lab”

8

First we start peStudio tool, run it as administrator and load Rams1 dot exe.

9

here it is, and there we go

10

You can see among many other information this file turns out to be a 32 bits file,

11

Now let me point out something, as a rule of thumb you should never trust only one tool,

12

then we are opening this also in CFF explorer, Once you have it installed just clic right on the executable and you’ll see the option

13

there we go

14

We can confirm, this is a 32 bits file and its signature is .net, it means was compiled in microsoft visual studio .net.

15

These two tools give us a lot of info, feel free to explore them.

16

Now we’ll scan our binary online using this trYd tool, you have the link in your resource section.

17

lets upload our binary

18

and press start

19

What this tool Is telling us is that is 79% percent sure this file is a .net assembly

20

Maybe you’re wondering why bother to scan the binary on several tools.

21

Well believe me sometimes the results are contradictory then is worth to try a few tools.

22

Ok lets continue, now open rams1 in cff explorer

23

And I am going to teach you how to identify the file type manually using the information in the portable structure.

24

You may have noticed that peStudio and cff explorer tools are getting info from our binary portable structure.

25

We’ll find many useful information here and we’ll dig in on this along the course, so don’t worry If you don’t understand this now

26

We select address converter and what we have here is Rams1 binary hexadecimal dump,

27

there is no way to falsify the hex dump, If you remember our lesson about Portable Structure you’ll recognize this 4d 5a,

28

this unequivocally id this file as a windows file

29

And what about the architecture?

30

Well we must locate the line with PE on it and look for this 4c 01, What this means?

31

Let me show you in this great online converter

32

Lets put here 4c01, analyze data and look for something call little endian which is the notation our hex dump use,

33

and we found it translates 14c.

34

Now lets visit the oficial portable structure microsoft site to find out what means 14c

35

and is equivalent to i386 proccessor you may know this means 32 bits.

36

Then now we are 100 percent sure this binary is 32/86 bits.

37

Now how do you know if this file is 64 bits, well easy if you don’t see here this 4c 01, well then this file is 64 bits, that's it.

38

Please join me to fingerprint this file in the next lesson